CVE-2026-46343 in Wazuh
Summary
by MITRE • 08/19/2026
Wazuh is a free and open source platform used for threat prevention, detection, and response. From 4.0.0 until 4.14.6 and 5.0.0-beta2, WazuhCommon.end_receiving_file() in framework/wazuh/core/cluster/common.py allows a cluster-authenticated node to delete files outside WAZUH_PATH. A syn_i_w_m_e request with an unknown task_id reaches the cleanup branch, where an attacker-controlled filename is passed to os.path.join without canonicalization or confinement. Absolute paths and traversal sequences can therefore target files such as ossec.conf, jwt_secret.json, TLS certificates, and ruleset files that are accessible to the Wazuh manager process. Deletion can disable the manager, invalidate API tokens, or disrupt cluster and API connectivity. This issue is fixed in versions 4.14.6 and 5.0.0-beta2.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 08/20/2026
Wazuh serves as a comprehensive open-source platform designed for threat prevention, detection, and response across distributed environments. Within its architecture, the cluster communication module handles file synchronization between nodes to maintain configuration consistency and data integrity. A critical vulnerability exists in the WazuhCommon.end_receiving_file function located within the framework/wazuh/core/cluster/common.py module. This flaw affects versions ranging from 4.0.0 through 4.14.6, as well as version 5.0.0-beta2. The security issue arises during the file reception process when a cluster-authenticated node initiates a syn_i_w_m_e request containing an unknown task_id. Under these specific conditions, the code path diverts to a cleanup branch where it attempts to remove temporary or processed files.
The core technical flaw lies in how the application handles filename parameters within this cleanup routine. The function passes an attacker-controlled filename directly into os.path.join without performing any canonicalization or confinement checks. This lack of validation allows for path traversal attacks, as the input is not sanitized against absolute paths or directory traversal sequences such as dot-dot-slash. Consequently, a malicious actor who has obtained valid cluster authentication credentials can manipulate this parameter to specify arbitrary file locations outside the designated WAZUH_PATH directory. By exploiting this mechanism, an attacker can target critical system files that are accessible by the Wazuh manager process, including ossec.conf, jwt_secret.json, TLS certificates, and ruleset configuration files.
The operational impact of this vulnerability is severe due to its potential for denial of service and compromise of security controls. Deleting or corrupting essential configuration files like ossec.conf can effectively disable the Wazuh manager, halting all monitoring and detection capabilities within the environment. Furthermore, the deletion of jwt_secret.json invalidates existing API tokens, disrupting automated integrations and potentially locking out legitimate administrators from managing the platform. The removal of TLS certificates breaks secure communication channels between cluster nodes and external services, leading to widespread connectivity failures across the security infrastructure. This disruption can create blind spots in threat detection, allowing malicious activities to go unnoticed while the organization attempts to restore service integrity.
From a classification perspective, this vulnerability aligns with CWE-22, which describes Improper Limitation of a Pathname to a Restricted Directory, commonly known as path traversal. The attack vector leverages authenticated access to manipulate file system operations, reflecting aspects of CWE-732 and CWE-409 related to unintended information exposure or data loss through improper handling of user-controlled inputs. In the context of the MITRE ATT&CK framework, this behavior corresponds to T1565.001, which involves Stored Data Manipulation via file deletion, allowing an adversary to disrupt service availability by removing critical system components. The exploitation requires prior authentication, placing it within the scope of lateral movement or privilege abuse after initial access has been established through compromised cluster credentials.
Mitigation strategies must prioritize immediate patching and strict input validation. Organizations running affected versions should upgrade immediately to Wazuh version 4.14.6 or later, which includes fixes for this path traversal issue. Until the update is applied, administrators should enforce rigorous network segmentation to limit access to cluster communication ports, ensuring that only trusted nodes can initiate synchronization requests. Additionally, implementing strict file system permissions and monitoring tools like auditd can help detect unauthorized deletion attempts of critical configuration files. Regular audits of authentication logs for syn_i_w_m_e requests with unknown task_ids are recommended to identify potential exploitation attempts in real-time.